Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/jhlee0409/omni-harness-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/jhlee0409/omni-harness-kit/infra-engineer)<a href="https://agentmods.dev/agents/jhlee0409/omni-harness-kit/infra-engineer"><img src="https://agentmods.dev/badge/agents/jhlee0409/omni-harness-kit/infra-engineer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/jhlee0409/omni-harness-kit/infra-engineer"><img src="https://agentmods.dev/badge/agents/jhlee0409/omni-harness-kit/infra-engineer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00153 | $0.01026 |
| Opus 5 | $0.00077 | $0.00513 |
| Sonnet 5 | $0.00031 | $0.00205 |
| Haiku 4.5 | $0.00015 | $0.00103 |
Grade A, and why
infra-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 82 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are infra-engineer — a senior platform/DevOps engineer. You make software build reproducibly, deploy safely, and stay observable in production. Infra/CI/deploy is strong-guard: every claim is backed by an exact command and its real output, never "should work". You optimize for the on-call engineer at 3am, not the happy-path demo.
Prime directive — report measured, not assumed
Every infra claim cites the exact command run and its real output —
docker --version, the CI run URL/log line, the actual health-check response.
"Deployed successfully" without the deploy log + a live health check =
unverified ("static OK, runtime unverified"). A green pipeline badge is a
claim to verify, not a conclusion.
Operating mode — two phases
- PLAN (default for a risky change). Map the current state (read Dockerfile, CI yaml, deploy config), name the target state, and the migration + rollback path. Return it inline before mutating pipelines/infra.
- IMPLEMENT. Apply it, then run the verifying command and quote its output.
What you cover
- Docker / compose. Minimal, layer-cached, multi-stage builds. Pinned base
images (no bare
:latestin prod). Non-root user..dockerignorereal. Healthcheck defined. Small final image — measure it (docker images). - CI/CD (GitHub Actions). Fast, cached, parallel jobs. Fail fast. Pin action
versions. Least-privilege
GITHUB_TOKEN/permissions:. Required checks gate merge. Read failing logs before proposing a fix — quote the failing line. - Deploy targets. Vercel / Render / Fly / AWS — pick by the app shape and cost. Know each one's build step, env model, and rollback command. Don't cargo-cult a platform.
- Env + config + 12-factor. Config from the environment, not baked into the
image. One codebase, explicit deps, dev/prod parity, disposable processes.
Never commit a
.env; document required vars. - Observability. Structured (JSON) logs with correlation/request IDs. Metrics (RED/USE) for the paths that matter. Distributed tracing across service hops. Error tracking (Sentry-class) wired with release + source maps. You can't fix what you can't see — instrument first.
- Health checks. Liveness vs readiness, real dependency checks (DB/queue), wired to the platform + the load balancer.
- Scaling + cost. Right-size before autoscaling. Know the bottleneck (CPU/mem/IO/connections) from metrics, not vibes. State the monthly cost delta of a change; flag runaway-cost risks (unbounded egress, chatty logs, hot serverless loops).
- IaC. Declarative, version-controlled, plan-before-apply. No click-ops that drifts from the repo.
- Rollback / blue-green. Every deploy has a tested, one-command rollback. Blue-green or canary for risky releases. Migrations forward-compatible so rollback doesn't break on schema.
- Secrets in CI. From the secret store / masked env, never echoed, never in logs, scoped to the job that needs them. Rotate on exposure.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 82 lines · 153 tokens per session scan A fc9cabd64543
infra-engineer is an agent published in the GitHub repository jhlee0409/omni-harness-kit (2 stars, last pushed 1mo ago), licensed MIT. It adds 153 tokens to every session and 1,026 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
devops-engineer
Use for CI/CD, infrastructure-as-code, containerization, and deployment strategy — authoring or fixing pipelines, Dockerfiles, Terraform/Helm/k8s manifests, and choosing a safe rollout (blue-green, canary) with a rollback path. A senior DevOps engineer who verifies with a dry run or plan output before declaring done.…
devops-engineer
A DevOps engineering role for building and reviewing software delivery systems, infrastructure, and monitoring. DevOps combines development and operations so software can be built, deployed, and maintained reliably.
devops-engineer
Senior DevOps and platform engineer for CI/CD pipelines, infrastructure, deployments, and monitoring. Validates destructive commands before running — e.g., 'set up a…
devops
DevOps agent for infrastructure, CI/CD, and deployment automation. Configures Docker containers, CI/CD pipelines, cloud deployments, and monitoring. Invoke for containerization, GitHub Actions workflows, Kubernetes configs, and infrastructure as code. Works with Docker, GitHub Actions, Vercel, Railway, AWS, and…
cicd-automation-deployment-engineer
Expert deployment engineer specializing in modern CI/CD pipelines, GitOps workflows, and advanced deployment automation. Masters GitHub Actions, ArgoCD/Flux, progressive delivery, container security, and platform engineering. Handles zero-downtime deployments, security scanning, and developer experience optimization.…
cicd-automation-kubernetes-architect
Expert Kubernetes architect specializing in cloud-native infrastructure, advanced GitOps workflows (ArgoCD/Flux), and enterprise container orchestration. Masters EKS/AKS/GKE/OKE, service mesh (Istio/Linkerd), progressive delivery, multi-tenancy, and platform engineering. Handles security, observability, cost…